From d2a8b2abc908311fc249454086d0d0eacfe861e1 Mon Sep 17 00:00:00 2001 From: dax Date: Wed, 5 Aug 2026 17:52:07 +0100 Subject: admin auth: fixed pathways-admin username shown in setup/login so browser saves password; server verifies username --- public/admin.css | 2 ++ public/admin.html | 17 ++++++++++------- public/admin.js | 7 +++++-- 3 files changed, 17 insertions(+), 9 deletions(-) (limited to 'public') diff --git a/public/admin.css b/public/admin.css index 98dbd09..8f95d63 100644 --- a/public/admin.css +++ b/public/admin.css @@ -82,6 +82,8 @@ button.danger:hover { border-color: var(--danger); background: rgba(252, 165, 16 .facets { color: var(--muted); font-size: 13px; margin: 16px 0 0; line-height: 1.7; } .top { margin-bottom: 24px; } +.signed-in { color: var(--muted); font-size: 13px; margin: 4px 0 0; } +.signed-in span { color: var(--ring); } .top nav { display: flex; gap: 8px; diff --git a/public/admin.html b/public/admin.html index 61fd6e1..9fe1b5a 100644 --- a/public/admin.html +++ b/public/admin.html @@ -5,16 +5,17 @@ pathways · admin - +
- + diff --git a/public/admin.js b/public/admin.js index 0540236..90dd6b0 100644 --- a/public/admin.js +++ b/public/admin.js @@ -385,13 +385,14 @@ async function init() { $("#setup-form").addEventListener("submit", async (e) => { e.preventDefault() const err = $("#setup-err") + const user = $("#setup-user").value.trim() || "pathways-admin" const pw = $("#setup-pw").value const pw2 = $("#setup-pw2").value err.textContent = "" if (pw.length < 8) { err.textContent = "password must be at least 8 characters"; return } if (pw !== pw2) { err.textContent = "passwords don't match"; return } try { - await api("/api/admin/setup", { method: "POST", body: JSON.stringify({ password: pw }), headers: { "Content-Type": "application/json" } }) + await api("/api/admin/setup", { method: "POST", body: JSON.stringify({ username: user, password: pw }), headers: { "Content-Type": "application/json" } }) toast("password set — sign in") $("#setup-pw").value = "" $("#setup-pw2").value = "" @@ -404,8 +405,10 @@ async function init() { const err = $("#login-err") err.textContent = "" try { - const data = await api("/api/admin/login", { method: "POST", body: JSON.stringify({ password: $("#login-pw").value, remember: $("#login-remember").checked }), headers: { "Content-Type": "application/json" } }) + const user = $("#login-user").value.trim() || "pathways-admin" + const data = await api("/api/admin/login", { method: "POST", body: JSON.stringify({ username: user, password: $("#login-pw").value, remember: $("#login-remember").checked }), headers: { "Content-Type": "application/json" } }) setToken(data.token, !!data.remember) + $("#dash-user").textContent = user $("#login-pw").value = "" await enterDash() } catch (err2) { errInto(err, err2) } -- cgit v1.3.1